Analysis
-
max time kernel
243s -
max time network
276s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 23:03
Static task
static1
Behavioral task
behavioral1
Sample
SAgHY0ulpFNs2qMqfbg8yFDVqT4LrAl6eycZV8w1.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
SAgHY0ulpFNs2qMqfbg8yFDVqT4LrAl6eycZV8w1.html
Resource
win7-20240221-en
General
-
Target
SAgHY0ulpFNs2qMqfbg8yFDVqT4LrAl6eycZV8w1.html
-
Size
146B
-
MD5
9fe3cb2b7313dc79bb477bc8fde184a7
-
SHA1
4d7b3cb41e90618358d0ee066c45c76227a13747
-
SHA256
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
-
SHA512
c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1604 msedge.exe 1604 msedge.exe 640 msedge.exe 640 msedge.exe 2192 identity_helper.exe 2192 identity_helper.exe 5900 msedge.exe 5900 msedge.exe 5900 msedge.exe 5900 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe 640 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 640 wrote to memory of 3620 640 msedge.exe msedge.exe PID 640 wrote to memory of 3620 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 3588 640 msedge.exe msedge.exe PID 640 wrote to memory of 1604 640 msedge.exe msedge.exe PID 640 wrote to memory of 1604 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe PID 640 wrote to memory of 1896 640 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\SAgHY0ulpFNs2qMqfbg8yFDVqT4LrAl6eycZV8w1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2ad946f8,0x7ffd2ad94708,0x7ffd2ad947182⤵PID:3620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:3588
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:1896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4632
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3352
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:2408
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:3888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:4520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:5280
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:12⤵PID:5288
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5970763780332661639,2264815575656058292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4636 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2140
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
Filesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
Filesize
6KB
MD5378ce7a23e638ed3c64943896df94d4f
SHA1ce6a0a67b524c20fadf0ce0c1d7ce9898a8075cd
SHA256e8b68b7fb295b25a12403cbe58813266af9c5644d3407b42d8657fa79515741e
SHA5128f6362cda4e5fd4453e77a140c41eeb0a61c183648ce47e167cbbc3ff25ff605e59ad38260180b48d09f6651d652f3a5fb24c7d7b93e59824c92306eb2d8993c
-
Filesize
6KB
MD541d90b98606c30cce85cecadbe24621d
SHA106c50cd2a8d15182aa7b9a9c4d89511078f15eae
SHA256b781a33cf5a4634f6a66995f032f75dae749457a328c9060e08f09f1630eb67b
SHA51275d881122c3861b5cf5dd08cfe980b42e0e3e3c01d6a36e95b7c9e527fef964f7bdb4051e91d87a8b48ba8ceed7e11f95a6ddc5f4b63fd61c0e2380072f5b37c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5896c2c5fd20f2b2219e10271a6794cb3
SHA1045c60cabe0abb73a8e99b144bc940af5d9c9b08
SHA256c83b11b5ff9dc9b5ec0c63832351cfeac2630184841693646b966b8a151fd654
SHA5129bce1599aa9277a8097cb5049238216dbecc156155add51ca1857a3f4418f8bce7d89a08ec0c6872468ae39dde6dda55076e7455c598892a235694fd47934a4a
-
Filesize
11KB
MD596ccb4104a70c7827f17ba336799f8c0
SHA150338c93f34ccf376c6593cac21efdbd44dd2838
SHA256027a5cd6c2fba4225e41fee34b098cd4b71085f7e9ae21d5a7aaa8bb656c22b1
SHA51274a15d0a20f2add06054ddf219e956aadc91f55998ea78451836a035d64b2bafb01ea21ff7fb453b948464e74566c7a33e5f7caa8314fc2f6cac7275f67fd1c8
-
Filesize
11KB
MD58d87e263cfb1774a480d23f43355b9cd
SHA107418d62043a3540d39ea08f2fc3eeeef1b02fd0
SHA256fc9772b0092ff8cb404e9f86034f5ca72ecd568209630fbdfd0d25ef4bf93235
SHA5123b68de5f17df5bd7f63268adfcda2f525b7242b0282e081dc6291e37eaac99c17c2a7edab3deca500d01334bec0e8180ed5f3889deb313d1d08a7231990ce287
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e